CVE-2026-7166

Multiple vulnerabilities in the Assassin game by Gaudire

View on CVE.org
Published Jun 22, 2026 CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Description
Vulnerability involving the exposure of sensitive data provided without adequate protection. The API exposes email and phone number data from the ‘email’ and ‘telefon’ fields. This vulnerability is also present in the local database, as it contains accessible sensitive information such as data on minors and municipal users. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain access to sensitive information and data.

Analysis

AI-generated

Technical impact

Vulnerability stemming from inadequate protection of user information in the Assassin game API and local database, allowing unauthenticated remote attackers to retrieve email and phone number fields and expose sensitive data regarding minors and municipal users. The weakness represents an unauthorized disclosure of private data, aligning with CWE-200.

Affected Systems

Gaudire’s Assassin game is the affected product. No specific version numbers are supplied, but the vulnerability exists in both the application’s API layer and its underlying local database.

Risk and Exploitability

The CVSS score of 9.2 signals a high severity of confidentiality compromise, while EPSS data is unavailable and the vulnerability is not present in CISA’s KEV catalog. Because the API is reachable over the network and no authentication is required, an attacker can simply issue HTTP requests to the exposed endpoints to harvest personal data. The combination of wide access scope, simplicity of exploitation, and lack of an immediate patch elevates the risk for organizations using this product.

Remediation

Vendor Solution

There is no reported solution at this time.

OpenCVE Recommended Actions

  • Disable or secure the API endpoints that expose the ‘email’ and ‘telefon’ fields by implementing mandatory authentication and role‑based access control.
  • Redact or encrypt sensitive columns in the local database and ensure that only authorized components can query them.
  • Conduct an immediate privacy audit to identify any other exposed data and enforce data minimization policies.
  • Monitor network traffic and application logs for anomalous data extraction attempts, and keep abreast of vendor advisories in case a patch becomes available.

Generated by OpenCVE AI on June 22, 2026 at 14:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Gaudire
Gaudire assassin Game
Vendors & Products Gaudire
Gaudire assassin Game
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Vulnerability involving the exposure of sensitive data provided without adequate protection. The API exposes email and phone number data from the ‘email’ and ‘telefon’ fields. This vulnerability is also present in the local database, as it contains accessible sensitive information such as data on minors and municipal users. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain access to sensitive information and data.
Title Multiple vulnerabilities in the Assassin game by Gaudire
Weaknesses CWE-200
References
Metrics cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N'}
Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

Sources

Status
PUBLISHED
Assigner
INCIBE
Published
Updated
Jun 22, 2026, 3:46 PM
Reserved
Apr 27, 2026, 7:25 AM

View source JSON

Updated
Jun 22, 2026, 3:46 PM

JSON

Status
Deferred
Published
Jun 22, 2026, 2:17 PM
Modified
Oct 25, 2026, 11:10 PM

View source JSON

No data.

Updated
Jun 23, 2026, 9:03 PM

JSON